DESCRIPTION:Multiple vulnerabilities have been reported in Mozilla Firefox, which can be exploited by malicious people to conduct cross-site scripting attacks or compromise a user's system.

1) An error within the handling of JavaScript references to frames and windows may in certain circumstances result in the reference not being properly cleared and allows execution of arbitrary code.

The vulnerability only affects the 1.5 branch.

2) An error within the handling of Java references to properties of the window.navigator object allows execution of arbitrary code if a web page replaces the navigator object before starting Java.

The vulnerability only affects the 1.5 branch.

3) A memory corruption error within the handling of simultaneously happening XPCOM events results in the use of a deleted timer object and allows execution of arbitrary code.

The vulnerability only affects the 1.5 branch.

4) Insufficient access checks on standard DOM methods of the top-level document object (e.g. "document.getElementById()") can be exploited by a malicious web site to execute arbitrary script code in the context of another site.

The vulnerability only affects the 1.5 branch.

5) A race condition where JavaScript garbage collection deletes a temporary variable still being used in the creation of a new Function object may allow execution of arbitrary code.

The vulnerability only affects the 1.5 branch.

6) Various errors in the JavaScript engine during garbage collection where used pointers are deleted and integer overflows when handling long strings e.g. passed to the "toSource()" methods of the Object, Array, and String objects may allow execution of arbitrary code.

7) Named JavaScript functions have a parent object created using the standard "Object()" constructor, which can be redefined by script.This can be exploited to run script code with elevated privileges if the "Object()" constructor returns a reference to a privileged object.

8) An error within the handling of PAC script can be exploited by a malicious Proxy AutoConfig (PAC) server to execute script code with escalated privileges by setting the FindProxyForURL function to the eval method on a privileged object that has leaked into the PAC sandbox.

9) An error within the handling of scripts granted the "UniversalBrowserRead" privilege can be exploited to execute script code with escalated privileges equivalent to "UniversalXPConnect".

10) An error can be exploited to execute arbitary script code in context of another site by using the "XPCNativeWrapper(window).Function(...)" construct, which creates a function that appears to belong to another site.

If you have Firefox installed, it should push out 1.5.0.5 automatically when you start the browser in order to secure the issue. My home machine updated last night and my work PC did so this morning the first time I opened it up.

This kind of thing will happen to any browser*. The best that we can say is that at least Firefox seems to be fixing their problems quickly.Secunia reports, for example, that 21 of 105 vulnerabilities in IE6 remain unpatched, including one rated "Highly Critical" (lvl 4 out of 5).With Firefox 1.x, 3 of 34 vulnerabilities are unpatched, with the highest being rated "Less Critical" (lvl 2 out of 5).

*Yes, I know that Secunia says that Opera 8.x has 0 of 15 vulnerabilities unpatched. But it's likely similar to the same reason that the Mac OS doesn't get viruses.

In the real world, WWE believes that no matter what our race, religious creed or ethnic background in America, we all share the common bond of being Americans. American-Arabs are a part of the fabric of America, and they should be embraced by all of us.